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UNITED STATES OF AMERICA, 
Plaintiff, 


UNITED STATES DISTRICT COURT 
FOR THE CENTRAL DISTRICT OF CALIFORNIA 

January 2 019 Grand Jury , 


V. 


TIMOTHY DALTON VAUGHN, 
aka "wantedbyfeds," 
aka "Wanted," 
aka "Hacker_R_US," 
aka "HDGZero," 
aka "Xavier Farbel," 
GEORGE DUKE-COHAN, 
aka "7R1D3N7," 
aka "Optlcz," 
aka "PI3x13t," 
aka "DigitalCrimes," 

Defendants. 


iND][CTMENT 

[18 U.S.C. § 371: Conspiracy; 18 
U.S.C. § 875(c): Threats to Injure 
in Interstate Commerce; 18 U.S.C. 

§ 844 (e) : Interstate Threats 
Involving Explosives; 18 U.S.C. 

§ 1030 (a) (5) (A) , (c) (4) (B) (i) , 

(c)(4)(A)(i)(I): Intentionally 
Damaging a Computer by Knowing 
Transmission; 18 U.S.C. 

§ 1030 (a) (7) (A) , (c) (3) (A) : 

Interstate Threat to Damage a 
Protected Computer with Intent to 
Extort; 18 U.S.C. § 2(a): Aiding 
and Abetting] 


The Grand Jury charges: 


COUNT ONE 
[18 U.S.C. § 371] 

A. INTRODUCTORY ALLEGATIONS 

1. At all times relevant to this Indictment: 

a. Apophis Squad was a collective of computer hackers and 
swatters and other individuals located throughout the world. 
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including the United States ("U.S."), that conducted cyber and 
swatting attacks against individuals and entities including school 
districts in the U.S. and the United Kingdom ("U.K."). These attacks 
included, among other things, the dissemination of bomb and school- 
shooting threats designed to cause fear of imminent danger and did 
cause the closure of hundreds of schools on two continents on 
multiple occasions. 

b. Defendant TIMOTHY DALTON VAUGHN, also known as ("aka") 
"wantedbyfeds," aka "Wanted," aka "Hacker_R_US," aka "HDGZero," aka 
"Xavier Farbel" ("VAUGHN") resided in, and was located in Winston- 
Salem, North Carolina. Defendant VAUGHN was a member of Apophis 
Squad who used the Twitter handles ©wantedbyfeds and @Hacker_R_US, 
and also shared the Twitter handles ©ApophisSquad and ©apophissquadv2 
with the other members of Apophis Squad, including defendant GEORGE 
DUKE-COHAN. 

c. Defendant GEORGE DUKE-COHAN, aka "7R1D3N7," aka 
"Optlcz," aka "Pl3xl3t," aka "DigitalCrimes" ("DUKE-COHAN") resided 
in, and was located in Hertfordshire, U.K. Defendant DUKE-COHAN was 
a member of Apophis Squad who used the Twitter handles @7R1D3N7, 
©DigitalCrimes, ©optlcz, and @Pl3xl3t, and also shared the Twitter 
handles ©ApophisSquad and ©apophissquadv2 with the other members of 
Apophis Squad, including defendant VAUGHN. 

d. Unindicted Co-Conspirator 1, aka "PartialDuplex," 
resided in, and was located in Hampshire, U.K. Unindicted Co- 
Conspirator 1 was a member of Apophis Squad who used the Twitter 
handle ©PartialDuplex. 

e. Twitter was an online social networking service on 
which users publicly post and interact with messages known as tweets. 
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Twitter users could also send private messages (called "Direct 
Messages" or "DMs") to one another. 

i. A Twitter "handle" was the name a user selected 

to use on Twitter, preceded by the symbol. 

ii. When publishing a tweet, the user had an option 
to "tag" another user by inserting the user's Twitter handle, which 
would alert the tagged user to the existence of the tweet. 

f. ProtonMail was a Switzerland-based email provider 
which offered secure encrypted email accounts. 

2. The following definitions apply to this Indictment: 

a. A "Distributed Denial of Service attack" or "DDoS 
attack" was a type of malicious computer activity by which an 
attacker causes a network of computers to "flood" a victim computer 
with large amounts of data or specific commands. As a result, the 
victim computer is unable to handle legitimate network traffic and 
legitimate users are denied the services of the computer. Depending 
on the type and strength of the DDoS attack, the victim computer and 
its network may become completely disabled and unable to perform 
their intended functions without significant repair. 

b. "Swatting" was the action or practice of harassing a 
victim by deceiving the victim or an emergency service into sending 
or causing to be sent police and emergency service response teams to 
the victim's location, often by making a false report of a serious 
law enforcement emergency such as a murder or bomb situation at the 
victim's location to trigger the deployment of the response teams. 

c. "Spoofing" was the creation of email messages with a 
forged, faked, or otherwise inauthentic sender address. 
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d. "Catfishing" was a type of deceptive activity whereby 
a person would create a fake identity and/or social media presence on 
the internet in order to target a specific victim or victims for 
deception. 

e. "Boxing" or "doxxing" was the publication of a 
person's personal information, usually including their true name and 
contact information. 

B. OBJECTS OF THE CONSPIRACY 

3. Beginning on a date unknown to the Grand Jury but no later 
than January 2018, and continuing through on or about August 31, 

2018, in Los Angeles, Orange, and Riverside Counties, within the 
Central District of California, and elsewhere, defendants VAUGHN and 
DUKE-COHAN, together with Unindicted Co-Conspirator 1 and others 
known and unknown to the Grand Jury, knowingly combined, conspired, 
and agreed to commit the following crimes: 

a. threats to injure in interstate commerce, in violation 
of Title 18, United States Code, Section 875(c); 

b. conveying false information concerning the use of an 
explosive device, in violation of Title 18, United States Code, 
Section 844(e); and 

c. intentionally damaging a computer by knowing 
transmission, in violation of Title 18, United States Code, Section 
1030(a)(5)(A). 

C. MANNER AND MEANS OF THE CONSPIRACY 

4. The objects of the conspiracy were carried out, and to be 
carried out, in substance, as follows: 

a. Using Internet communication applications such as 
Discord and Internet Relay Chat ("IRC") rooms, defendants VAUGHN and 
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DUKE-COHAN and the other members of Apophis Squad, including 
Unindicted Co-Conspirator 1, would plan to and would send emails 
containing bomb and school-shooting threats to hundreds of school 
districts in the U.S. and the U.K., knowing that those threats were 
fa.lse and with knowledge that the emails would be viewed as threats. 

b. For some of the threats, defendants VAUGHN and DUKE- 
COHAN and the other members of Apophis Squad, including Unindicted 
Qo-Conspirator 1, would spoof email addresses to make it appear as if 
the bomb and school-shooting threats were sent by other entities such 
as the mayor of London, VeltPVP, and Zonix. 

c. Defendants VAUGHN and DUKE-COHAN and the other members 
of Apophis Squad, including Unindicted Co-Conspirator 1, would DDoS 
or deface the websites of entities with which they were displeased. 

D. OVERT ACTS 

5. On or about the following dates, in furtherance of the 
conspiracy, and to accomplish its objects, defendants VAUGHN and 
DUKE-COHAN, as well as Unindicted Co-Conspirator 1 and others known 
and unknown to the Grand Jury, committed and caused others to commit 
the following overt acts, among others, in the Central District of 
California, and elsewhere: 

Overt Act No. 1: lu or about January 2018, defendants VAUGHN 

and DUKE-COHAN and the other members of Apophis Squad defaced the 
website of Colombian university Colegio Nueva Granada ("CNG"), 

WWW.eng.edu. 

Overt Act No. 2: On or about January 14, 2018, defendant 

VAUGHN DDoSed the website belonging to Hoonigan Industries, located 
in Long Beach, California (hoonigan.com), for approximately three 
days during which the website was rendered inoperable. 
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Overt Act No. 3: On or about January 15, 2018, defendant 

VAUGHN bragged in an IRC chat room that he had DDoSed hoonigan.com. 

Overt Act No. 4: On or about January 28, 2018, defendant 

DUKE-COHAN called the Federal Bureau of Investigation's ("FBI's") 
Omaha, Nebraska Field Office ("FBI Omaha") and asked the operator if 
defendant DUKE-COHAN should pack an Ebola or anthrax dispersal weapon 
to deploy in the lobby of the FBI, and when the operator did not 
respond, defendant DUKE-COHAN threatened to rape and kill the 
operator's wife. 

Overt Act No. 5: A few hours later, on or about January 28, 

2018, defendant DUKE-COHAN called FBI Omaha again and claimed he was 
going to set off a pipe bomb at Los Angeles International Airport 
("LAX") on July 4, 2018; was going to set off a bomb at his school on 
January 29, 2018, because he was too excited to wait; claimed 
responsibility for hacking a Colombian university; and said he was 
going to go stab his mother. 

Overt Act No. 6: On or about January 29, 2018, defendant 

DUKE-COHAN, through a public posting using the Twitter handle 
@7R1D3N7, took credit for the defacement of CNG's website. 

Overt Act No. 7: On or about January 29, 2018, defendant 

DUKE-COHAN, through a public posting using the Twitter handle 
@7R1D3N7, posted a screenshot of cng.edu with a picture of Adolf 
Hitler holding a sign with the words "YOU ARE HACKED" with the text 
that CNG's Website had been "Hacked by APOPHIS SQUAD - OFFICIAL 
APOPHIS SQUAD HACK" and "KEEP THIS UP OR PEOPLE DIE! HAHA LAX 4TH 
July BOMB!" 

Overt Act No. 8: On or about January 29, 2018, defendant 

DUKE-COHAN, through a public posting using the Twitter handle 
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@7R1D3N7, stated: "Will they ever learn good SEC[URITY]....I am a 
skid.... do not hak me! Cng.edu < PWN DB leaked. 

(Jake_DAVIS_LEFT_EYE) ©briankrebs ©FBIOmaha told you I hacked them!" 

Overt Act No. 9: On or about January 30, 2018, defendant 

VAUGHN, using the Twitter handle ©wantedbyfeds, stated to another 
Twitter user that he was catfishing a man in Cottondale, Florida. 

Overt Act No. 10: On or about January 30, 2018, defendant 

DUKE-COHAN, assisted by defendant VAUGHN (who was communicating with 
defendant DUKE-COHAN during the call), and posing as "Jake Davis" 
from Cottondale, Florida, called FBI Omaha and took credit on behalf 
of Apophis Squad for the CNG defacement. 

Overt Act No. 11: Between on or about March 16 and 19, 2018, 

defendants VAUGHN and DUKE-COHAN, together with Co-Conspirator 1 and 
the other members of Apophis Squad, sent emails appearing to be sent 
by VeltPVP, a company that hosts player versus player Minecraft game 
servers, to hundreds of schools in the U.K. in both English and 
Arabic threatening that a student had been sent to the school with a 
bomb that would detonate in three hours unless $5,000 USD was sent to 
VeltPVP. 

Overt Act No. 12: On or about March 19, 2018, defendant DUKE- 

COHAN, through a public posting using the Twitter handle 
©ApophisSquad, stated: "We hope everyone in the UK enjoyed our email. 
Thanks to all who participated in this event," and signed it with his 
moniker, Pl3xl3t. 

Overt Act No. 13: On or about March 28, 2018, defendant DUKE- 

COHAN, together with the other members of Apophis Squad, sent emails 
on behalf of Apophis Squad signed with defendant DUKE-COHAN's 
moniker, Pl3xl3t, threatening that a car would drive into as many 


7 









1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 


Case 2:19-cr-00071-ODW Document 1 Filed 02/08/19 Page 8 of 26 PagelD#:8 


students as possible as they exited the school, and if the school 
tried to evacuate the driver would shoot. 

Overt Act No. 14: On or about March 28, 2018, defendant DUKE- 

COHAN, through a public posting using the Twitter handle 
©ApophisSquad, stated: "Schools out for the DAY! Hope all you HARD 
working students get our emails. Do not panic... they are fake... we 
think," and signed it with his moniker, Pl3xl3t. 

Overt Act No. 15: In or about April 2018, defendant VAUGHN 

compiled a list of U.S. school districts and their email addresses 
and sent the list to defendant DUKE-COHAN. 

Overt Act No. 16: On or about April 8, 2018, defendant DUKE 

COHAN, through a public posting using the Twitter handle 
©ApophisSquad, stated: "We are holding off on UK schools till they 
are ALL back from holiday. We are still on track for the US." 

Overt Act No. 17: On or about April 8, 2018, defendant DUKE- 

COHAN, through a public posting using the Twitter handle 
©ApophisSquad, stated: "Shit, we sent the emails to early. Our bad 
on that one we were testing and we used the wrong list for the 

test. We would like to say sorry for the small amount of evacs 

this has caused. We will aim to fix this soon!" 

Overt Act No. 18: On or about April 8, 2018, defendant DUKE- 

COHAN, through a public posting using the Twitter handle 
©ApophisSquad, stated: "The CEO of ©ZonixUS and the developers took 
the option to make fun of us. All players + staff will now be the 
target of Doxing & Swatting. All email fallout is now pointed at 
Zonix and will soon not be a server," and tagged the Twitter user 
with the handle @cbrady350. 
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Overt Act No. 19: On or about April 8 and 9, 2018, defendant 

DUKE-COHAN, together with the other members of Apophis Squad, sent 
emails appearing to be sent by Apophis Squad with a reply email 
address to Zonix, a company that hosts player versus player Minecraft 
video game servers, to school districts in the U.S. -- including 
school districts in El Segundo, Mission Viejo, Tustin, Garden Grove, 
Santa Ana, Redlands, Jurupa Valley, Riverside, Chino, and Lompoc, 
within the Central District of California -- threatening that a 
bullied student was coming to school with three bombs and a .22- 
caliber handgun to shoot any staff or student member. 

Overt Act No. 20: On or about April 10, 2018, defendant VAUGHN 

created an IRC chat room with the description "feds.apophissquad.xyz 
Powered by School Shootings and Bomb Threats, in which he 
communicated with defendant DUKE-COHAN and Unindicted Co-Conspirator 

1 . 

Overt Act No. 21: On or about April 10, 2018, defendant DUKE- 

COHAN participated in an interview moderated by the individual using 
the email cbrady350@gmail.com and stated that he uses the monikers 
Pl3xl3t and 7R1D3N7; gave a "shout-out" for the ©apophissquadv2 
Twitter handle; stated that he and the other members of Apophis Squad 
had accidentally sent the threat emails from April 8 and 9, 2018, 
early to a small number of schools; and stated that Apophis Squad was 
planning on "leaking the U.S. military database." 

Overt Act No. 22: On or about April 11, 2018, defendant VAUGHN 

bragged to an individual named Jason in an IRC chat room: "[W]e have 
hit more then 2k schools. 400+ in uk. 2k+ in us. more stuff coming 
Friday." 
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Overt Act No. 23: On or about April 12 and 13, 2018, 

defendants VAUGHN and DUKE-COHAN, together with Co-Conspirator 1 and 
the other members of Apophis Squad, sent emails appearing to be sent 
by Apophis Squad from Mineplex, a company that hosts player versus 
player Minecraft video game servers, to school districts in the U.S. 
and the U.K. -- including school districts in Burbank, El Segundo, La 
Verne, Anaheim, La Habra, Huntington Beach, Fullerton, Tustin, 
Riverside, Fillmore, Santa Maria, and Lompoc, within the Central 
District of California -- threatening that a student with two bombs 
made of ammonium nitrate/fuel oil ("ANFO") would go to school and set 
off the bombs, and included a photograph of a plastic bottle ANFO 
bomb. 

Overt Act No. 24: On or about April 12, 2018, defendant DUKE- 

COHAN, through a public posting using the Twitter handle 
@apophissquadv2, retweeted a tweet about the school bomb threat, 
which included the photograph of the plastic bottle ANFO bomb. 

Overt Act Mo. 25: On or about April 12, 2018, defendant DUKE- 

COHAN, through a public posting using the Twitter handle 
@apophissquadv2, stated: "Email scraping has just hit 52k emails 
found, UK & U.S! We got our servers ready but do you? Just think 
24k to the UK clear 400 schools, Ik to the U.S closed like 30... 52k is 
just going to be MEMES. . . ." 

Overt Act No. 26: On or about April 12, 2018, defendant DUKE- 

COHAN, through a public posting using the Twitter handle 
@apophissquadv2, stated: "We take request for school clear outs / 
lockdowns. If you want to SKIP a lesson? Maybe not do that exam? 
Email us your school: apophissquad@tuta.io we do it free & easy." 
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Overt Act No. 27: On or about April 12, 2018, defendant DUKE- 

COHAN, through a public posting using the Twitter handle 
@apophissquadv2, stated: "Tango down ~ U.S + UK Schools We are 
Apophis Squad and we are HERE to stay! We 100% going dark now... Hope 
the U.S and UK enjoy it, if we get arrested then oops we must of 
messed up at some point." 

Overt Act No. 28: On or about April 12, 2018, defendant DUKE- 

COHAN told defendant VAUGHN to "go get a fuck ton of US school 
emails! ONLY US schools this time. nothing else. UNDERSTAND THAT. 
NOTHING ELSE," to which defendant VAUGHN replied, "will do." 

Overt Act No. 29: On or about April 13, 2018, defendant DUKE- 

COHAN called FBI Omaha, identified himself as the caller who had 
previously threatened to rape the operator's wife, reiterated his 
bomb threat on LAX, and asked questions about the bomb threats made 
on U.S. schools. 

Overt Act No. 30: On or about April 13, 2018, defendant DUKE- 

COHAN, through a public posting using the Twitter handle 
@apophissquadv2, stated: "We are OPEN for request for school 
lockdowns / evacs. Send us your request to apophissquad@tuta.io 
(FREE)." 

Overt Act No. 31: On or about April 15, 2018, defendant DUKE- 

COHAN, through a public posting using the Twitter handle 
@apophissquadv2, posted a screenshot of a live web chat between him 
and the Hertfordshire Police in the U.K., in which he stated: "You 
have not caught any of us and we plan on hitting the UK & US schools 
today *Tmr*," and clarified that "we" meant Apophis Squad. 

Overt Act No. 32: On or about April 15, 2018, defendant DUKE- 

COHAN, through a public posting using the Twitter handle 
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®apophissquadv2, stated: "We plan on hitting as many schools as we 
can on Monday! Wq hope anyone that just wants to have a day off or 
maybe get out of the math test you have I Will email us any schools 
we are working hard on getting 100k emails!" 

Overt Act Mo. 33: On or about April 15, 2018, defendant DUKE- 

COHAN, through a public posting using the Twitter handle 
@apophissquadv2, stated: "This is how we get in the mood before we 
build our bombs & send the emails," and included a link to the song 
labeled "Foster The People Pumped Up Kicks columbine ..." 

Overt Act No. 34: On or about April 17, 2018, defendant VAUGHN 

possessed a copy of the image of the plastic bottle ANFO bomb on his 
computer. 

Overt Act No. 35: On or about May 5, 2018, defendant DUKE- 

COHAN, through a public posting using the Twitter handle 
@apophissquadv2, stated: "Request open for schools! Email us or DM 
us. Send in dem emails! WE BACK BOIS!" 

Overt Act No. 36: On or about May 7, 2018, defendant DUKE- 

COHAN, through a public posting using the Twitter handle 
@apophissquadv2, stated: "Little hint in the email \'APS\' is used, 
stand for Apophis Squad if the media did not know." 

Overt Act No. 37: On or about May 7 and 8, 2018, defendants 

VAUGHN and DUKE-COHAN, together with the other members of Apophis 
Squad, sent emails to school districts in the U.S. and the U.K. -- 
including school districts in Beverly Hills, Redondo Beach, Glendora, 
La Verne, Mission Viejo, and Thermal, within the Central District of 
California -- appearing to be sent by either the Director-General of 
the U.K.'s National Crime Agency ("NCA") or the Chief Executive 
Officer of the U.K.'s Marz Media, and threatening that three bombs 
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placed under school transport vehicles and one in the school would 
explode unless $5,000 USD was paid to cbradY350@gmail.com. 

Overt Act No. 38: On or about May 8, 2018, defendant DUKE- 

COHAN, through a public posting using the Twitter handle 
@apophissquadv2, stated: "Oops @cbrady350 you about to get $5,000 USD 
in ur paypal! HEHEHE Better pay up bois or school could go BOOM!" 

Overt Act No. 39: On or about May 8, 2018, defendant DUKE- 

COHAN, through a public posting using the Twitter handle 
@apophissquadv2, stated: "First Email work. Now we wait for the 
second to work its magic." 

Overt Act No. 40: On or about June 26, 2018, defendants VAUGHN 

and DUKE-COHAN, and the other members of Apophis Squad, sent emails 
signed "APS" to school districts in the U.S. and the U.K. -- 
including school districts in Buena Park and Santa Paula, within the 
Central District of California -- appearing to be sent from the mayor 
of London threatening that two rocket-propelled grenade ("RPG") heads 
placed under two school buses and four land mines placed on the 
sports field and around its entrance would detonate unless school was 
cancelled because they are "not happy" with the way that the schools 
"let these boys and girls dress and not worship Alah the God" and 
allow girls to be educated. 

Overt Act No. 41: On or about June 26, 2018, defendant DUKE- 

COHAN, through a public posting using the Twitter handle 
@apophissquadv2, tweeted at the mayor of London: "Hit us up when you 
wish to comment on why you sent bomb threats? Apophis Team is BACK," 
and tagged defendant VAUGHN'S Twitter handle @Hacker_R_US. 
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Overt Act Mo. 42: On or about June 27, 2018, defendants VAUGHN 

and DUKE-COHAN, on behalf of Apophis Squad, began a week-long DDoS 
attack on the computer servers of ProtonMail. 

Overt Act No. 43: On or about June 27, 2018, defendant DUKE- 

COHAN, through a public posting using the Twitter handle 
@apophissquadv2, tweeted at ©ProtonMail: "SHIT DDOS PROT[ECTION]!!! 
©ProtonMailHelp your website is DOWN!!! Can't take 200gbps SSDP 
attack. LOL!!! !" 

Overt Act No. 44: On or about June 27, 2018, defendant DUKE- 

COHAN, through a public posting using the Twitter handle 
@apophissquadv2, tweeted at the Chief Technology Officer of 
ProtonMail: "Say sorry for calling us clowns and we will allow your 
network backup!" 

Overt Act No. 45: On or about June 28, 2018, defendant DUKE- 

COHAN, through a public posting using the Twitter handle 
@apophissquadv2, tweeted at ProtonMail: "We will down your network no 
matter who your with. . . . [W]ait till you leave and then we will 

strike and it will HURT!!!" 

Overt Act No. 46: On or about August 9, 2018, defendant DUKE- 

COHAN, through a public posting using the Twitter handle 
@apophissquadv2: "LOOOL 7 US Marshalls just tried to Raid 
@Hacker_R_US [defendant VAUGHN] bitch did not have a search warrant! 
Come back later n[****]. You aint got SHIT! Feds can't touch us!" 

Overt Act No. 47: On or about August 9, 2018, defendant DUKE- 

COHAN, assisted by defendant VAUGHN, called San Francisco 
International Airport ("SFO") Operations while United Airlines flight 
949 ("UAL 949") from London Heathrow to SFO was in the air, claiming 
to be the father of a passenger on that flight who had communicated 
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to him mid-flight that the plane had been hijacked by four men with 
weapons and explosives. 

Overt Act No. 48: On or about August 9, 2018, defendant DUKE- 

COHAN, through a public posting using the Twitter handle 
@apophissquadv2: "One thing to say! UAL949 Grounded bitch! Don't 
try and raid our members next time! HAHAHAHA.... 4 guys 1 bomb back 
of the plane?.... 9/11 remake! -Wanted & Optlcz." 

Overt Act No. 49: On or about August 9, 2018, defendant DUKE- 

COHAN, assisted by defendant VAUGHN, called San Francisco Police 
Department's Airport Bureau continuing to claim to be the father of a 
passenger on UAL 949, adding that the passengers were being forced to 
the back of the airplane, and providing his phone number and the 
email address optlcz@apophissquad.ru as his contact information, 
causing the plane to be sent to a quarantined area upon landing in 
San Francisco where it remained for hours until security checks could 
be conducted. 
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COUNT TWO 

[18 U.S.C. §§ 875(c); 2(a)] 

On or about April 8 and. 9, 2018, defendants TIMOTHY DALTON 
VAUGHN, also known as ("aka") "wantedbyfeds," aka "Wanted," aka 
"Hacker_R_US," aka "HDGZero," aka "Xavier Farbel" and GEORGE DUKE- 
COHAN, aka "7R1D3N7," aka "Optlcz," aka "Pl3xl3t," aka 

"DigitalCrimes," each aiding and abetting the other, with the purpose 
of issuing a threat and with knowledge that the communication would 
be viewed as a threat, knowingly transmitted in interstate commerce 
to school districts in El Segundo, Mission Viejo, Tustin, Garden 
Grove, Santa Ana, Redlands, Jurupa Valley, Riverside, Chino, and 
Lompoc, in Los Angeles, Orange, Santa Barbara, and Riverside 
Counties, within the Central District of California, the following 
communication containing true threats to injure the person of 
another: 

Hello, you have made a choice to not listen to us. I got 
bullied at this school and you did nothing. Now you will 
understand the true mean of pain. I am coming into school 
with 3 bombs, and a .22 hand gun. If I see any staff or 
student I will shoot them and kill them. When I run out of 
bullets, I will slit there throats and watch them bleed out 
on the floor. If I see any police at the school I will 
blowup the bombs. 
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COUNT THREE 

[18 U.S.C. §§ 875(c); 2(a)] 

On or about April 12 and 13, 2018, defendants TIMOTHY DALTON 
VAUGHN, also known as ("aka") "wantedbyfeds," aka "Wanted," aka 
"Hacker_R_US," aka "HDGZero," aka "Xavier Farbel" and GEORGE DUKE- 
COHAN, aka "7R1D3N7," aka "Optlcz," aka "Pl3xl3t," aka 

"DigitalCrimes," each aiding and abetting the other, with the purpose 
of issuing a threat and with knowledge that the cotniriunication would 
be viewed as a threat, knowingly transmitted in interstate commerce 
to school districts in Burbank, El Segundo, La Verne, Anaheim, La 
Habra, Huntington Beach, Fullerton, Tustin, Riverside, Fillmore, 

Santa Maria, and Lompoc, in Los Angeles, Orange, Santa Barbara, and 
Riverside Counties, within the Central District of California, the 
following communication containing true threats to injure the person 
of another; 

Hello, a male student will be sent into your campus as you 
start the day, he will look normal but what is in his bag 
is a bomb. The explosive that is in the two plastic bottles 
is called ANFO it is a very powerful explosive. The point 
is that when you put the school on lockdown this student 
will set off the bomb, and will kill EVERY student in the^ 
room and maybe the rooms next to it. It has an LDR which is 
used to stop bag searchs. It will exploded if any light 
hits the sensor. We follow in the foot steps of our two 
heros who died in the Columbine High School shooting. 

Natural selection is coming and we plan on being the onse 
to start it off. We understand that you may want to contact 
the FBI or Law enforcement but note, that we have pick 5 
schools to do this to, your school could be the one to be 
hit or it could be a lucky one and gets to be picked at a 
different time. The point is nobody but us will know which 
school is to be hit. We also have pressure plated pvc pipes 
at the exists with 12 gauge shot guns shells so if anyone 
steps on them it will shot through the student. We will 
have a sniper watching the exits with concreate with a 
ruger 10/22. 
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COUNT FOUR 

[18 U.S.C. §§ 875 (c) ; 2(a)] 

On or about May 7 and 8, 2018, defendants TIMOTHY DALTON VAUGHN, 
also known as ("aka") "wantedbyfeds," aka "Wanted," aka 
"Hacker_R_US," aka "HDGZero," aka "Xavier Farbel" and GEORGE DUKE- 
COHAN, aka "7R1D3N7," aka "Optlcz," aka "Pl3xl3t," aka 

"DigitalCrimes," each aiding and abetting the other, with the purpose 
of issuing a threat and with knowledge that the cominunication would 
be viewed as a threat, knowingly transmitted in interstate commerce 
to school districts in Beverly Hills, Redondo Beach, Glendora, La 
Verne, Mission Viejo, and Thermal, in Los Angeles, Orange, and 
Riverside Counties, within the Central District of California, the 
following communication containing true threats to injure the person 
of another: 

I will make this simple. Tuesday 05/08/2018 9:30AM, 3 PVC 
pipe bombs placed under school transport will explode. I 
will then set off the main pipe bomb hidden in the school. 

This is what you get for not listening to me. See you all 
in HELL. Or pay us $5,000 USD Via paypal to 
cbrady350@gmail.com. 
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COUNT FIVE 

[18 U.S.C. §§ 875(c) ; 2 (a)] 

On or about June 26, 2018, defendants TIMOTHY DALTON VAUGHN, 
also known as ("aka") "wantedbyfeds," aka "Wanted," aka 
"Hacker R US," aka "HDGZero," aka "Xavier Farbel" and GEORGE DUKE- 
COHAN, aka "7R1D3N7," aka "Optlcz," aka "Pl3xl3t," aka 

"DigitalCrimes," each aiding and abetting the other, with the purpose 
of issuing a threat and with knowledge that the communication would 
d© viewed as a threat, knowingly transmitted in interstate commerce 
to school districts in Buena Park and Santa Paula, in Los Angeles and 
Ventura Counties, within the Central District of California, the 
following communication containing true threats to injure the person 
of another: 

We are not happy with the way you let these boys and girls 
dress and not worship Alah the God. We have planted 2 RPG 
heads under 2 school busses and 4 land mines on the sports 
field and around the entrance... If you cancel the school 
we will not blow it up, if you keep school on and allow^ 
girls to be educated we will blow up the bomb and come in 
school every girl in the school including teachers. Any 
sign of POLICE we will kill each student one by one. We 
have members in the school who are students they have^ 
orders to SHOOT if you try and evacuate the school. Simple. 
Follow the rules or be killed. -APS. 
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COUNT SIX 

[18 U.S.C. §§ 844 (e) , 2(a)] 

On or about April 8 and 9, 2018, defendants TIMOTHY DALTON 

VAUGHN, also known as ("aka") "wantedbyfeds," aka "Wanted," aka 

"Hacker R US," aka "HDGZero," aka "Xavier Farbel" and GEORGE DUKE- 

COHAN, aka "7R1D3N7," aka "Optlcz," aka "Pl3xl3t," aka 

"DigitalCrimes," each aiding and abetting the other, by email and 

other instrument of commerce, willfully made a threat, and 

maliciously conveyed false information knowing the information to be 

false, to the school districts in El Segundo, Mission Viejo, Tustin, 

Garden Grove, Santa Ana, Redlands, Jurupa Valley, Riverside, Chino, 

and Lompoc, in Los Angeles, Orange, Santa Barbara, and Riverside 

Counties, within the Central District of California, concerning an 

alleged attempt being made, or to be made, to kill, injure, and 

intimidate an individual and to damage and destroy property by means 

of fire and an explosive, namely: 

Hello, you have made a choice to not listen to us. I got 
bullied at this school and you did nothing. Now you will 
understand the true mean of pain. I am coming into school 
with 3 bombs, and a .22 hand gun. If I see any staff or 
student I will shoot them and kill them. When I run out of 
bullets, I will slit there throats and watch them bleed out 
on the floor. If I see any police at the school I will 
blowup the bombs. 
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COUNT SEVEN 

[18 U.S.C. §§ 844(e), 2(a)] 

On or about April 12 and 13, 2018, defendants TIMOTHY DALTON 

VAUGHN, also known as ("aka") "wantedbyfeds," aka "Wanted," aka 

"Hacker R US," aka "HDGZero," aka "Xavier Farbel" and GEORGE DUKE- 

COHAN, aka "7R1D3N7," aka "Optlcz," aka "Pl3xl3t," aka 

"DigitalCrimes," each aiding and abetting the other, by email and 

other instrument of commerce, willfully made a threat, and 

maliciously conveyed false information knowing the information to be 

false, to the school districts in Burbank, El Segundo, La Verne, 

Anaheim, La Habra, Huntington Beach, Fullerton, Tustin, Riverside, 

Fillmore, Santa Maria, and Lompoc, in Los Angeles, Orange, Santa 

Barbara, and Riverside Counties, within the Central District of 

California, concerning an alleged attempt being made, or to be made, 

to kill, injure, and intimidate an individual and to damage and 

destroy property by means of fire and an explosive, namely: 

Hello, a male student will be sent into your campus as you 
start the day, he will look normal but what is in his bag 
is a bomb. The explosive that is in the two plastic bottles 
is called ANFO it is a very powerful explosive. The point 
is that when you put the school on lockdown this student 
will set off the bomb, and will kill EVERY student inthe^ 
room and maybe the rooms next to it. It has an LDR which is 
used to stop bag searchs. It will exploded if any light 
hits the sensor. We follow in the foot steps of our two 
heros who died in the Columbine High School shooting. 

Natural selection is coming and we plan on being the onse 
to start it off. We understand that you may want to contact 
the FBI or Law enforcement but note, that we have pick 5 
schools to do this to, your school could be the one to be 
hit or it could be a lucky one and gets to be picked at ^ a 
different time. The point is nobody but us will know which 
school is to be hit. We also have pressure plated pvc pipes 
at the exists with 12 gauge shot guns shells so if anyone 
steps on them it will shot through the student. We will 
have a sniper watching the exits with concreate with a 
ruger 10/22. 
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COUNT EIGHT 

[18 U.S.C. §§ 844 (e) , 2 (a)] 

On or about May 7 and 8, 2018, defendants TIMOTHY DALTON VAUGHN, 

also known as ("aka") "wantedbyfeds," aka "Wanted," aka 

"Hacker_R_US," aka "HDGZero," aka "Xavier Farbel" and GEORGE DUKE- 

COHAN, aka "7R1D3N7," aka "Optclz," aka "Pl3xl3t," aka 

"DigitalCrimes," each aiding and abetting the other, by email and 

other instrument of commerce, willfully made a threat, and 

maliciously conveyed false information knowing the information to be 

false, to the school districts in Beverly Hills, Redondo Beach, 

Glendora, La Verne, Mission Viejo, and Thermal, in Los Angeles, 

Orange, and Riverside Counties, within the Central District of 

California, concerning an alleged attempt being made, or to be made, 

to kill, injure, and intimidate an individual and to damage and 

destroy property by means of fire and an explosive, namely: 

I will make this simple. Tuesday 05/08/2018 9:30AM, 3 PVC 
pipe bombs placed under school transport will explode. I 
will then set off the main pipe bomb hidden in the school. 

This is what you get for not listening to me. See you all 
in HELL. Or pay us $5,000 USD Via paypal to 
cbrady350@gmail.com. 
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COUNT NINE 

[18 U.S.C. §§ 844(e), 2(a)] 

On or about June 26, 2018, defendants TIMOTHY DALTON VAUGHN, 

also known as ("aka") "wantedbyfeds," aka "Wanted," aka 

"Hacker R US," aka "HDGZero," aka "Xavier Farbel" and GEORGE DUKE- 

COHAN, aka "7R1D3N7," aka "Optclz," aka "Pl3xl3t," aka 

"DigitalCrimes," each aiding and abetting the other, by email and 

other instrument of commerce, willfully made a threat, and 

maliciously conveyed false information knowing the information to be 

false, to the school districts in Buena Park and Santa Paula, in Los 

Angeles and Ventura Counties, within the Central District of 

California, concerning an alleged attempt being made, or to be made, 

to kill, injure, and intimidate an individual and to damage and 

destroy property by means of fire and an explosive, namely; 

We are not happy with the way you let these boys and girls 
dress and not worship Alah the God. We have planted 2 RPG 
heads under 2 school busses and 4 land mines on the sports 
field and around the entrance... If you cancel the school 
we will not blow it up, if you keep school on and allow^ 
girls to be educated we will blow up the bomb and come in 
school every girl in the school including teachers. Any 
sign of POLICE we will kill each student one by one. We 
have members in the school who are students they have^ 
orders to SHOOT if you try and evacuate the school. Simple. 
Follow the rules or be killed. -APS. 
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COUNT TEN 

[ 18 U.S.C. §1030(a)(5)(A), (c){4)(B)(i), {c)(4)(A)(i)(I)] 

On or about January 14, 2018, in Los Angeles County, within the 

Central District of California, and elsewhere, defendant TIMOTHY 

DALTON VAUGHN, also known as ("aka") "wantedbyfeds," aka "Wanted," 

aka "Hacker_R_US," aka "HDGZero," aka "Xavier Farbel" ("VAUGHN") 

knowingly caused the transmission of a program, information, code, 

and command, and as a result of such conduct, intentionally and 

without authorization impaired the integrity and availability of 

data, a program, a system, and information on a protected computer, 

as that term is defined in Title 18, United States Code, Section 

1030(e) (2) (B) , that is, the computer servers of Cogeco Peer 1, which 

hosted the website hoonigan.com belonging to Hoonigan Industries 

("Hoonigan"), thereby causing a loss to Hoonigan, aggregating at 

least $5,000 in value during a one-year period beginning on or about 

/ 

January 14, 2018. 


24 




1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 


Case2:19-cr-00071-ODW Document 1 Filed 02/08/19 Page 25 of 26 PagelD#:25 


COUNT ELEVEN 

[18 U.S.C. § 1030(a)(7), (c)(3)(A)] 

On or about January 14, 2018, in Los Angeles County, within the 
Central District of California, and elsewhere, defendant TIMOTHY 
DALTON VAUGHN, also known as ("aka") "wantedbyfeds," aka "Wanted," 
aka "Hacker_R_US," aka "HDGZero," aka "Xavier Farbel" ("VAUGHN"), 
with intent to extort from any person any money or thing of value, 
transmitted in interstate and foreign commerce the following 
communication containing a threat to impair the integrity and 
availability of data, a program, a system, and information on a 
protected computer, as that term is defined in Title 18, United 
States Code, Section 1030(e)(2)(B), that is, the computer servers of 
Cogeco Peer 1, which hosted the website hoonigan.com belonging to 
Hoonigan Industries: 

You have 24 hours to pay 1.5 BTC to [the Bitcoin wallet 
address ending in Glxg] to stop the attacks on you website. 

If you do not pay within the 24 hours the payment to stop 
the attacks will be 2 btc. This is not a joke and this is 
to be taken seriously. You can Proudly Direct Message me 
When you have paid on twitter OWantedbyfeds 

Or When i completely receive the payment i will see it and 
stop the attacks. We have the ability to avoid any DDOS 
mitigation tactics you might pay to be deployed. We have 
dumped your clients database and if u try to avoid paying 

// 

// 

// 

// 

// 

// 

// 

// 
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we will release all your customers information. We have 
Emails, Name, address, and full details on the payment 
methods and payment details! 


A TRUE BILL 



Foreperson 


NICOLA T. HANNA 
United States Attorney 



PATRICK R. FITZGERALD 

Assistant United States Attorney 

Chief, National Security Division 

RYAN WHITE 

Assistant United States Attorney 
Chief, Cyber & Intellectual 
Property Crimes Section 

JENNIE L. WANG 

Assistant United States Attorney 
Deputy Chief, Cyber & Intellectual 
Property Crimes Section 
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